Encryption circuit randomness inspector and method

ABSTRACT

A baseband processor of a communication device, the baseband processor including an encryptor block that encrypts a transmit data stream into an encrypted data stream, at least one transmit chain block that transforms the encrypted data stream into an analog transmit signal, and a randomness inspector unit that is in communication with the encryptor block, the randomness inspector unit accessing the transmit data stream and the encrypted data stream from the encryptor block as first and second input streams, respectively, to the randomness inspector unit, and determining a randomness gain by comparing a first randomness measurement associated with the first input stream to a second randomness measurement associated with the second input stream.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a Continuation of U.S. patent application Ser. No.17/119,257, filed on Dec. 11, 2020, entitled “Encryption CircuitRandomness Inspector and Method” which claims the benefit of priority toU.S. Provisional Patent Application No. 63/116,757 filed on Nov. 20,2020, entitled “Encryption Circuit Randomness Inspector and Method”, thecontents of which are incorporated herein by reference.

FIELD OF THE INVENTION

The inventions described herein relate to a randomness inspector thatdetermines the encryption strength of one or more components in anencryption circuit. The inventions herein further relate to a basebandprocessor, an application processor, a processor with a built inencryption circuitry, or a processor capable of running an encryptionmethod in which a randomness inspector determines the encryptionstrength of one or more components of the processors mentioned in theabove.

BACKGROUND

In general, encryption is commonly used to securely store data and tosecure communications between devices. Encryption is standard in mostcellular and broadband communications protocols today such as LTE,Wi-Fi, WiMAX, Bluetooth, virtual private networks (VPN), etc. and isexpected to remain a standard as other forms of communications, such aslow earth orbit (LEO) satellite networks, gain more use. Encryption hasbeen and continues to be used in military communications, commercial,and private communications systems. These systems may be wired,wireless, satellite, RF, optical, acoustic, etc. Participating devicesin such networks and systems may include but are not limited to laptop,personal computers, servers, cell phones, smartphones, satelliteterminals and phones, satellites, ground stations, Internet of Things(IoT) devices, sensors, hard drives, external backup devices, cloudstorage, communications network infrastructure, and any other devicethat may have the capability to exchange or store data.

An important challenge facing designers of an encryption method,encryption circuitry or any information scrambling system is to ensure,with a reasonable degree of reliability, that the encryption method (orcircuit) has a high cryptographic strength that makes it infeasible fora cryptanalyst or any state or non-state adversary to apply brute forcetechniques to break the encryption key or compromise the associatedcryptographic strength of the encryption ciphering or scrambling methodor system. The known methods for checking the cryptographic strength ofan encryption method or system are to utilize the encryption testingsuites like the one proposed by National Institute of Standards andTechnology (NIST) to measure the randomness of a block cipher or astream cipher, generally consisting of confusion and diffusion modules,by treating the encryption or scrambling system as a black box such thatthe individual components or modules of the system are not visible orindividually tested. The NIST test suite is only an example embodimentof a randomness testing suite, and test suites in general are notlimited to NIST only. Some other known examples of encryption testsuites are DieHarder, TestU01, ENT, and RNG Analysis. A shortcoming ofthe above-mentioned test suites—like NIST—is that they do not provideany insight into the component level strength of an encryption method,circuitry, or system. As a result, the designers and users of anencryption method or a scrambling system are unable to objectivelyevaluate the cryptographic strength of each of the components(constituent submodules) of the encryption method or a scramblingsystem. Such components can include, for example, the S-Box (sometimesreferred to as a Confusion Box), the Mangling Function, the Roundslogic, and the key-expansion submodules. Consequently, it is notpossible to know whether the encryption or scrambling system is composedof strong constituent submodules. A Mangling Function consists of eithera Confusion Box or a Diffusion Box or a cascaded combination of both toencrypt or scramble the input data stream bits.

In an encryption method or a system, the confusion is introduced using anonlinear S-box (sometimes referred to as a Confusion Box) that makes itdifficult for a cryptanalyst to formulate its functionality by knownlinear functions and/or their transformations. A cryptographicallystrong S-box resists against linear, differential, and algebraicattacks. Some known design methods for designing and constructingS-boxes are: (1) random generation method; (2) weighted nonlinearBoolean functions; (3) nonlinear transformation combined with a linertransformation using affine function (just like in AES); (4) applyinground permutations on large number of small S-boxes; (5) pseudorandomnumber generation by applying Secure Hashing Algorithm-1 (SHA-1) thatmeets the required differential and linear criterion; and (6)key-dependent S-boxes (as in in Serpent). The eventual outcome of thisdesign process is a mapping matrix with the following set of parameters:(1) the size of an S-box (number of elements); (2) the dimension of anS-box (number of rows and columns); and (3) the number of substitutedbits (nibble, byte or 32 bits word). There is not seen to be an existingmethod, system or device that allows a user to benchmark thecryptographic strength of heterogeneous S-boxes of different encryptionmethods against each other especially when their designers are notwilling to share the design and the mapping matrix of these S-boxes.Accordingly, there is not seen to be a method, system or device thatcould be used to benchmark the cryptographic strength of an S-box if theS-box is only shared as a black box in the form of a dll (or some othertype of executable).

Similarly, the randomness introduced by the Diffusion, which scramblesthe substituted data by directly permuting the substituted bits or usingsome partial functionality of the mangling function and further applyingpermutations and other logical operations in a round of an encryptionmethod to avoid patterns in the cipher text, cannot be measured byexisting cryptanalyzing techniques. The same is also true for thekey-expansion or key-scheduling modules.

Encryption has important applications in wireless communication systems.In this regard, the International Telecommunication Union (ITU) definedthree principle usage scenarios for 5G: Enhanced Mobile Broadband(eMBB), Ultra Reliable Low Latency Communications (uRLLC), and MassiveMachine Type Communications (mMTC) and IoT applications. These servicesinclude the constraint to have low latency but with a high degree ofboth mobility and security. 5G applications and usage can be found intechnical areas, such as, autonomous vehicles that have high safetydependency on reliability and latency; Industry 4.0 which facilitatesthe wireless control of industrial manufacturing; e-Health such asremote medical care and surgery; rescue support robot; public security;aviation; and other mission critical applications. The 5G/6G eMBB can beextended from conventional terrestrial communications to aerialcommunications such as unmanned aerial vehicle (UAV) cellular mmWavecommunications and low earth orbit (LEO) satellite communications.

Cloud virtualization technologies such as software-defined networks(SDN) and network functions virtualization (NFV) are new paradigms for5G/6G networks. However, due to such technologies' open, flexible, andprogrammable nature they bring new security concerns. For example, anetwork element of an SDN, such as the management interfaces, could beused to attack the SDN controller or management system and compromisethe security of the whole SDN system.

The detection of security threats in such communication and computingsystems is the first step towards mitigating a security breach by anadversary. 5G/6G requires end-to-end security that automatically detectsand mitigates all types of security breaches including informationsecurity breaches. However, as discussed above, known encryption testingtechniques are not seen to provide the ability to test encryptionstrength of various components within an encryption system or circuit.

SUMMARY OF THE INVENTION

In an aspect, a baseband processor of a communication device isprovided, the baseband processor including an encryptor block thatencrypts a transmit data stream into an encrypted data stream, at leastone transmit chain block that transforms the encrypted data stream intothe analog transmit signal, and a randomness inspector unit that is incommunication with the encryptor block, the randomness inspector unitaccessing the transmit data stream and the encrypted data stream fromthe encryptor block as first and second input streams, respectively, tothe randomness inspector unit, and determining a randomness gain bycomparing a first randomness measurement associated with the first inputstream to a second randomness measurement associated with the secondinput stream.

In another aspect, a baseband processor of a communication device isprovided for transforming a received analog signal into a received datastream, the baseband processor including at least one receive chainblock that transforms the received analog signal into a receivedencrypted data stream, a decryptor block that decrypts the receivedencrypted data stream into a received decrypted data stream, and arandomness inspector unit that is in communication with the decryptorblock, the randomness inspector unit accessing the received decrypteddata stream and the received encrypted data stream from the decryptorblock as first and second input streams, respectively, to the randomnessinspector unit, and determining a randomness gain by comparing a firstrandomness measurement associated with the first input stream to asecond randomness measurement associated with the second input stream.

In a further aspect, an encryption circuit is provided for transformingan input data stream into an encrypted data stream, the encryptioncircuit including an encryptor block that encrypts the input data streaminto the encrypted data stream, and a randomness inspector unit that isin communication with the encryptor block, the randomness inspector unitaccessing the input data stream and the encrypted data stream from theencryptor block as first and second input streams, respectively, to therandomness inspector unit, and determining a randomness gain bycomparing a first randomness measurement associated with the first inputstream to a second randomness measurement associated with the secondinput stream.

In an aspect, a method is provided for determining a randomness gainassociated with an encrypted data stream, the method comprising thesteps of encrypting a transmit data stream into the encrypted datastream, transforming the encrypted data stream into an analog transmitsignal, and conducting a randomness inspection that includes the stepsof accessing the transmit data stream and the encrypted data stream, anddetermining the randomness gain by comparing a first randomnessmeasurement associated with the transmit data stream to a secondrandomness measurement associated with the encrypted data stream.

In another aspect, a method is provided for determining a randomnessgain associated with a received encrypted data stream, the methodincluding the steps of transforming a received analog signal into thereceived encrypted data stream, decrypting the received encrypted datastream into a received decrypted data stream, conducting a randomnessinspection that includes the steps of accessing the received decrypteddata stream and the received encrypted data stream, and determining therandomness gain by comparing a first randomness measurement associatedwith the received decrypted data stream to a second randomnessmeasurement associated with the received encrypted data stream.

In a further aspect, a method is provided for determining an encryptionstrength of an encryption circuit for transforming an input data streaminto an encrypted data stream, the method comprising the steps ofencrypting, by an encryption block in the encryption circuit, the inputdata stream into the encrypted data stream, and conducting a randomnessinspection that includes the steps of accessing the input data streamand the encrypted data stream, and determining a randomness gain bycomparing a first randomness measurement associated with the input datastream to a second randomness measurement associated with the encrypteddata stream.

In an aspect, a randomness amplifier is provided for determining arandomness gain associated with an encryption block that transforms aninput data stream into an encrypted data stream, the randomnessamplifier including a randomness enhancer that applies the encryptionblock to the input data stream to generate the encrypted data stream, atleast one randomness evaluator that applies at least one randomness testblock to the input data stream to determine a first randomnessmeasurement and that applies the at least one randomness test block tothe encrypted data stream to determine a second randomness measurement,and a gain meter that determines a randomness gain by comparing thefirst randomness measurement associated with the input data stream tothe second randomness measurement associated with the encrypted datastream.

In a further aspect, a benchmarked randomness inspector is provided fordetermining a randomness gain difference associated with at least twodifferent data streams, the benchmarked randomness inspector including arandomness amplifier that receives a first input data stream as an inputand applies a standard encryption block to the first input data streamto generate a standard encrypted data stream, and that determines afirst randomness gain by comparing a first randomness measurementassociated with the first input data stream to a second randomnessmeasurement associated with the standard encrypted data stream, arandomness comparator that receives the first input data stream and asecond encrypted data stream as inputs, the second encrypted data streambeing generated by application of a second encryption block to the firstinput data stream, and that determines a second randomness gain bycomparing the first randomness measurement associated with the firstinput data stream to a third randomness measurement associated with thesecond encrypted data stream, and a difference calculator thatdetermines the randomness gain difference by comparing the firstrandomness gain to the second randomness gain.

In yet another aspect, a randomness amplifier is provided fordetermining a randomness gain associated with any one of a plurality ofencryption blocks in a network stack, the randomness amplifier includinga randomness enhancer that applies one of the plurality of encryptionblocks to an input data stream to generate an encrypted data stream, atleast one randomness evaluator that applies at least one randomness testblock to the input data stream to determine a first randomnessmeasurement and that applies the at least one randomness test block tothe encrypted data stream to determine a second randomness measurement,and a randomness gain meter that determines a randomness gain bycomparing the first randomness measurement associated with the inputdata stream to the second randomness measurement associated with theencrypted data stream.

In another aspect, a randomness comparator is provided for determining arandomness gain associated with any two of a plurality of data streamsthat includes at least two input data streams and at least two outputencrypted data streams, the randomness comparator including at least onerandomness evaluator that applies at least one randomness test block toa first one of the plurality of data streams to determine a firstrandomness measurement and that applies the at least one randomness testblock to a second one of the plurality of data streams to determine asecond randomness measurement, and a randomness gain meter thatdetermines the randomness gain by comparing the first randomnessmeasurement to the second randomness measurement.

In a further aspect, a differential randomness comparator fordetermining a randomness gain difference between a first randomness gainassociated with a first randomness amplifier and a second randomnessgain associated with a second randomness amplifier, the differentialrandomness comparator including a first randomness amplifier thatreceives a first input data stream as an input and applies a firstencryption block to the first input data stream to generate a firstencrypted data stream, and that determines a first randomness gain bycomparing a first randomness measurement associated with the first inputdata stream to a second randomness measurement associated with the firstencrypted data stream, a second randomness amplifier that receives afirst input data stream as an input and applies a second encryptionblock to the first input data stream to generate a second encrypted datastream, and that determines a second randomness gain by comparing thefirst randomness measurement associated with the first input data streamto a third randomness measurement associated with the second encrypteddata stream, and a difference calculator that determines the randomnessgain difference by comparing the first randomness gain to the secondrandomness gain.

In an aspect, a randomness scope is provided for comparing a first setof randomness gain values associated with a first randomness amplifierto a second set of randomness gain values associated with a secondrandomness amplifier, the randomness scope including an input sectionthat accesses the first set of randomness gain values from a firstmemory, the first set of randomness gain values including a separaterandomness gain value generated by the first randomness amplifier usingeach one of a plurality of different encryption component blocks, andthat accesses the second set of randomness gain values from a secondmemory, the second set of randomness gain values including a separaterandomness gain value generated by the second randomness amplifier usingeach one of the plurality of different encryption component blocks, arandomness curve generator that generates a first set of randomnesscurves associated with the first set of randomness gain values and asecond set of randomness curves associated with the second set ofrandomness gain values, and a randomness distance display that displaysany of the first set of randomness curves and any of the first set ofrandomness curves based on one or more randomness curve selection inputsfrom a user interface, at least one randomness curve selection inputbeing associated with one of the plurality of different encryptioncomponent blocks.

In another aspect, a deep cipher investigator is provided fordetermining whether one or more of a first plurality of differentencryption component blocks is in a compromised state, the deep cipherinvestigator including a first randomness amplifier that generates afirst set of randomness gain values including a separate randomness gainvalue generated by the first randomness amplifier using each one of thefirst plurality of different encryption component blocks, a secondrandomness amplifier that generates a second set of randomness gainvalues including a separate randomness gain value generated by thesecond randomness amplifier using each one of a second plurality ofdifferent encryption component blocks, a randomness curve generator thatgenerates a first set of randomness curves associated with the first setof randomness gain values and a second set of randomness curvesassociated with the second set of randomness gain values, and arandomness display that displays any of the first set of randomnesscurves and any of the second set of randomness curves, wherein acomparison of at least one of the first set of randomness curves to atleast one of the second set of randomness curves determines whether oneor more of the first plurality of different encryption component blocksis in a compromised state.

The foregoing aspects, and other features and advantages of theinvention, will be apparent from the following, more particulardescription of aspects of the invention, the accompanying drawings, andthe claims.

BRIEF DESCRIPTION OF THE DRAWINGS

Details of one or more implementations of the subject matter of theinvention are set forth in the accompanying drawings briefly describedbelow and the related description set forth herein. Other objects,features, aspects, and advantages will become apparent from thedescription, the drawings, and the claims. Note that the relativedimensions of the drawings may not be drawn to scale. Like referencenumbers and designations in the various drawings indicate like elements.

FIG. 1 is a top-level diagram of a typical transceiver architecture fora broadband MIMO wireless radio and/or fiber optic communication system;

FIG. 2 is a functional diagram depicting a baseband processor with arandomness inspector according to aspects of the invention;

FIG. 3 is a functional diagram of a randomness inspector according toaspects of the invention;

FIG. 4 is a diagram depicting an input data stream generator accordingto aspects of the invention;

FIG. 5 is a top-level diagram of a randomness amplifier according toaspects of the invention;

FIG. 6 is a functional diagram of a randomness amplifier according toaspects of the invention;

FIG. 7 is a functional diagram of a randomness enhancer according toaspects of the invention;

FIG. 8 is a functional diagram of a randomness evaluator according toaspects of the invention;

FIG. 9 is a functional diagram of a randomness gain meter according toaspects of the invention;

FIG. 10 is a functional diagram of a randomness gain plot generatoraccording to aspects of the invention;

FIG. 11 is a functional diagram of a randomness analyzer systemaccording to aspects of the invention;

FIG. 12 is a top-level diagram of a randomness amplifier with correlatedartifacts subtracted from the output stream according to aspects of theinvention;

FIG. 13 is a functional diagram of a randomness comparator according toaspects of the invention;

FIG. 14 is a functional diagram of a benchmarked randomness inspectoraccording to aspects of the invention;

FIG. 15 is a functional diagram depicting a baseband processor with arandomness inspector having switchable inputs according to aspects ofthe invention;

FIG. 16 is a functional diagram of a randomness inspector withswitchable inputs according to aspects of the invention;

FIG. 17 is a is a top-level diagram of a differential randomnesscomparator with two randomness amplifiers according to aspects of theinvention;

FIG. 18 is a top-level diagram of a differential randomness comparatorwith two randomness amplifiers having correlated artifacts subtractedfrom the output stream according to aspects of the invention;

FIG. 19 is a flowchart depicting a process for a randomness inspectionof at least one data stream in a circuit according to aspects of theinvention;

FIG. 20 is a flowchart depicting a process for a randomness amplifieraccording to aspects of the invention;

FIG. 21 is a flowchart depicting a process for a benchmarked randomnessinspection of at least one data stream in a circuit according to aspectsof the invention;

FIG. 22 is a flowchart depicting a process for a randomness amplifierwith selectable inputs according to aspects of the invention;

FIG. 23 is a flowchart depicting a process for a randomness comparatoraccording to aspects of the invention;

FIG. 24 is a flowchart depicting a process for a differential randomnesscomparator according to aspects of the invention; and

FIG. 25 is a flowchart depicting a process for a randomness scopeaccording to aspects of the invention.

DETAILED DESCRIPTION

Aspects of the present invention and their advantages may be understoodby referring to the figures and the following description. Thedescriptions and features disclosed herein can be applied to variousdevices, systems, software, and methods in encryption circuits andsystems, such as for example in a baseband processor of a communicationsystem device or in an application processor of a user equipment deviceor in any general purpose processor having built in encryption circuitryor that is capable of running an encryption method.

In an aspect of the present invention, an encryption circuit such as abaseband processor includes a randomness inspector that determines therandomness strength of an output data stream relative to the input datastream of one or more components of the circuit (baseband processor).

FIG. 1 shows a top-level block diagram of a typical transceiverarchitecture of devices in a broadband MIMO wireless radio communicationsystem 100, which also includes a fiber optic interface. As seen in FIG.1 , a flexible wireless transceiver architecture is shown for devicesgNB (NodeB, or base station) 102 and UE (user equipment) 134 that istypical for a 5G or high order MIMO (sub-6 GHz 5G NR) system, a 5G orhigher mmWave system, an IEEE 802.11a/b/g/n/ac/ax system, an IEEE802.11ad/ay system, a WiGig system, a Bluetooth system, a GNSS system, a5G-CA system, a 5G-LAA system, etc. The gNB 102 of multiple antenna MIMOsystem 100 consists of antenna 110, the LNA (Low Noise Amplifier) and PA(Power Amplifier) 108, the Duplexer and Time Switch (TS) 132, and PhaseShifter (ϕ) 106 which are analog components working at GHz frequencies,and ADC and DAC 104 which are mixed signal components. In the case ofthe FDD (Frequency Division Duplex) system the duplexer is utilized butis replaced with the Time Switch (TS) in the case of a Time DivisionDuplexing (TDD) system. gNB 102 also includes baseband processor 112 forradio communication. The components of UE (User Equipment) 134 aresimilar to that of gNB 102, and include antenna 136, the LNA (Low NoiseAmplifier) and PA (Power Amplifier) 140, the Duplexer and Time Switch(TS) 137, and Phase Shifter (ϕ) 142 which are analog components workingat GHz frequencies, and ADC and DAC 144. UE 134 can be an IoT machine ora human user device and has one or multiple Baseband Processors (BBP)146 depending upon the chip architecture, necessary processing power,and schemes used for low power operation. On the gNB 102 (base stationor BT) side, in addition to the above-mentioned hardware blocks, a FiberOptic (FO) interface is also present in order to connect the basestation with a cloud-based IT infrastructure (such as for backhaul). TheFO interface has its own dedicated BBP 114, and in the transmissionchain also includes DAC 116, modulator 118, and laser LED 120 (foroutgoing fiber optic medium 122), The FO interface includes in itsreceive chain phototransistor 124 (for receiving signals from fiberoptic medium), demodulator 126 and ADC 128. Memory 130 is also providedin gNB 102 to store data for BBPs 112 and 114. Similarly, UE 134 alsoincludes memory 138 to store data for BBP 146. UE also includes userinterface 148 which may be a display, keyboard, touchscreen, buttons,sensors, and or other known types of user interface devices.

From the functional point of view, the BBPs of the UE, the BS, and theFO are all similar. The BBPs have their own specific architecture and adedicated operating system. All the digital functions are implemented inthe BBP, which includes coding, interleaving, equalization, estimation,compression, sampling, rate conversion, transformation, pulse shapingand modulation etc. Encryption methods are utilized in gNB 102 and UE134 and are implemented in the baseband processor(s) of each. Aspects ofthe invention as described herein may be implemented in or applied tothe BBP of a LIE, BS, or FO. In this regard, aspects of the invention asdescribed as herein may be implemented in or applied to the BBP(communications link encryption) for communications with the UE, for theBS airlink, and also the BS backhaul. Aspects of the invention asdescribed herein may also be implemented in or applied to an applicationprocessor, especially for example an application processor of a UE thatsupports UE end-to-end encryption.

FIG. 2 is a functional diagram of a baseband processor 200, such as BPP146 of FIG. 1 , wherein the baseband processor includes a randomnessinspector 216 according to aspects of the invention. As seen in FIG. 2 ,baseband processor (BBP) 200 is shown which is suitable for differenttypes of radios and FOC systems. BBP 200 consists of, but is not limitedto, Encryptor 204, Channel Selection 206, Spreader 208, Serializer 210,and Modulator 212 in the transmit chain. As seen in the transmit chain,Transmit Data 202 is input to BBP 200 which processes it by blocks 204to 212 and outputs modulated data to DAC 214 to thereby result in ananalog output signal, such as for transmission. In the receiver chain ofBBP 200, the main blocks are Demodulator 222, Deserializer 224,Despreader 226, Channel Deselection 228, and Decryptor 230. As seen inthe receiver chain, an analog signal-in (such as from an antenna) isinput to ADC 220 which sends modulated data into BBP 200 in which it isprocessed by blocks 222 to 230 and outputs decrypted received data 232.These above-mentioned blocks make up the main part of any kind of BPPpresent in typical radio and fiber optic (FO) communication systems. BBP200 also includes Randomness Inspector 216.

According to an aspect of the invention, Randomness Inspector 216computes the randomness gain between two data streams and may alsocompute a randomness distance of two data streams. The randomness gainand/or the randomness distance can be used to find out whether theencryption method applied between the two data streams (such as inputand output data streams) is defective or has been compromised ordisabled by an adversary attack. In case of a problem or security breachof the encryption method, BPP 200 can alert the system (such as theoperating system of a gNB or a UE) to take the mitigationcountermeasures. Randomness Inspector 216 can be implemented using theexisting resources in BPP 200 or a dedicated hardware and can berealized within the baseband processor chip or a separate security chip.

As seen in FIG. 2 , the data stream under investigation can be thetapped from the output of Encryptor block 204 to determine a problem orcompromise in the encryption of that particular block, and the severityand the type of an adversary attack. This investigation can be appliedon the whole band, a sub-band, or a complete channel of the sub channelsof the TDMA and FDMA, CDMA or spread spectrum systems.

In order to detect the attack, the input S_(ix) and output S_(ox) ofEncryptor block 204 are tied to the two inputs S_(ix) and S_(ox) ofRandomness Inspector 216, respectively. |R_(GAIN)| values computedinside the Randomness Inspector 216 measure the randomness distancebetween input and output data streams. |R_(GAIN)| and both S_(ix) andoutput S_(ox) can be used directly or stored in a memory (not shown) fora later use.

Randomness Inspector 216 can be comprised of comparator blocks asdescribed further below with respect to FIG. 3 . In this manner, ifEncryptor 204 is enabled then |R_(GAIN)| of the top comparator blockinside the Randomness Inspector 216 should correspond to a highrandomness distance between the two data streams, and ΔGAIN of thebottom comparator block inside the Randomness Inspector 216 shouldcorrespond to a difference between reference and measured randomnessdifferences that is less than a threshold; otherwise, Encryptor 204 mayhave been turned off or degraded to a fake encryptor such as ILLUZIJA (apseudo name for a fake encryptor that simply copies an input stream tothe output stream) and hence this compromise could be easily detected.An undetected ILLUZIJA attack could significantly reduce thecryptographic strength of the output ciphered data stream S_(ox) andaccordingly would lead to a security breach of the information in thatdata stream.

The outputs of Randomness Inspector 216 are a randomness distancemeasure |R_(GAIN)| between the reference stream (S_(ix)) and the datastream under investigation (S_(ox)) and the difference (Δ) betweenreference and measured randomness differences |R_(GAIN-REF)| and|R_(GAIN)|. If the difference (Δ) between reference randomnessdifference |R_(GAIN-REF)| and the measured randomness difference|R_(GAIN)| for the two data streams is more than a threshold (δ), thenthe system is determined to have been compromised; and thus, may enablethe system controller to take appropriate steps to mitigate the adverseeffects of this type of encryption defect or security attack. Referencerandomness difference |R_(GAIN-REF)| may be, for instance, a calculationof the long-term randomness gain of a well-known encryption scheme suchas AES. As seen in FIG. 2 , Randomness Inspector 216 can also performthe same functions as described above with regard to the receive chainof BBP 200. Specifically, input S_(ox) (an encrypted data stream) andoutput S_(ix)(a decrypted data stream) of Decryptor block 230 are alsoprovided to the two inputs S_(ix) and S_(ox) of Randomness Inspector216, respectively. Randomness Inspector 216 can determine whether toinspect the data streams from the transmit chain or the receive chainbased on an Input Mode Flag which is input to Randomness Inspector 216from a user interface or from memory. Similar to the above descriptionregarding the inspection of data streams from encryptor 204, whenRandomness Inspector 216 determines to inspect the data streams from thereceive chain based on the Input Mode Flag, |R_(GAIN)| values arecomputed inside Randomness Inspector 216 which measure the randomnessdistance between input and output data streams of Decryptor 230.|R_(GAIN)| and both S_(ix) and output S_(ox) in this instance can beused directly or stored in a memory (not shown) for a later use. Forexample, in the case that Randomness Inspector 216 operates as shown inFIG. 3 and as discussed in more detail below, if Decryptor 230 isenabled then |R_(GAIN)| of the top comparator block (such as randomnesscomparator 304 of FIG. 3 ) inside the Randomness Inspector 216 shouldcorrespond to a high randomness distance between the two data streams,and the Δ_(GAIN) of the bottom comparator block (such as randomnesscomparator 308 of FIG. 3 ) inside the Randomness Inspector 216 shouldcorrespond to a difference between reference and measured randomnessdifferences that is more than a threshold; otherwise, Decryptor 230 mayhave been turned off or degraded to a fake decryptor such as ILLUZIJA (apseudo name for a fake decryptor that simply copies an input stream tothe output stream) and hence this compromise could be easily detected.

FIG. 3 is a functional diagram of a randomness inspector according toaspects of the invention, such as for example Randomness Inspector 216of FIG. 2 . In FIG. 3 , Randomness Inspector 300 is shown in which twodata streams S_(ix) and S_(ox) are input from one of two sets of inputs(for example, inputs from either a transmit chain or a receive chain ofa BPP). FIG. 3 shows two data streams S_(ix) and S_(ox) from anencryptor block and two data streams S_(ix) and S_(ox) from a decryptorblock being provided to switch 302. In this regard, switch 302 can belocated in Randomness Inspector 300 or can be located outside ofRandomness Inspector 300, such as in a separate component or function ofa circuit in which Randomness Inspector 300 resides, such as for examplethe BBP 200 shown in FIG. 2 . Switch 302 can be implemented in acircuit, logic, or other known means. Alternatively, switch 302 may beoptional in the case that Randomness Inspector 300 is configured to onlyaccept inputs from an encryptor block (such as in the transmit chain ofBBP 200) or to only accept inputs from a decryptor block (such as in thereceive chain of BBP 200). An Input Mode Flag is also provided to switch302 which instructs switch 302 whether to use the data streams S_(ix)and S_(ox) from the encryptor block or from the decryptor block and thenoutput them as selected data streams S_(ix) and S_(ox) to the Comparator304. In the case of using data streams from the encryptor block, S_(ix)is an input data stream before encryption, and S_(ox) is an output datastream after encryption. In the case of using data streams from thedecryptor block, S_(ox) is an input data stream before decryption, andS_(ix) is an output data stream after decryption. These two data streamsmay represent the initial input data stream and final output data streamof an entire encryption chain or circuit (or decryption chain orcircuit, as the case may be), or may represent different data streamsfrom any different respective points, stages or components in anencryption chain or circuit (or decryption chain or circuit), such as aBPP for example. Comparator 304 of Randomness Inspector 300 determines arandomness gain |R_(GAIN)| between input data streams S_(ix) and S_(ox)and may also optionally include a difference calculator 308 whichcalculates the difference between the |R_(GAIN)| output of RandomnessComparator 304 and a reference |R_(GAIN)|. If the difference calculator308 determines a difference (Δ) in the two |R_(GAIN)| values that ismore than a predetermined threshold (δ), then it is determined that thetwo data streams are not very close in randomness space and thereforemay indicate an encryption or decryption problem, whichever the case maybe.

FIG. 19 is a flowchart depicting a process for a randomness inspectionof at least one data stream in a circuit according to an aspect. Theprocess of FIG. 19 may apply to any circuit that includes an encryptionor scrambling block, model, or process such as in a baseband processorcircuit, an application processor circuit, or any other encryption orscrambling circuit. As seen in FIG. 19 , the process begins at step 1901in which the randomness inspector checks the input mode flag todetermine whether to use input data streams from a block in the transmitchain (such as the encryption block) or from a block in the receivechain (such as the decryption block). In step 1902, the decision is madebased on the input mode flag to use the encryption block (transmitchain) or the receive block (such as the decryption block) for inputs.If, in step 1902, it is decided to use the encryption block (or anyother block in the transmit chain) the process moves to step 1914 whichencrypts a transmit data stream into the encrypted data stream using theencryption block. Next, in step 1916, a randomness inspection isconducted that includes the step 1918 of accessing the transmit datastream and the encrypted data stream and the step 1920 of determining arandomness gain by comparing a first randomness measurement associatedwith the transmit data stream to a second randomness measurementassociated with the encrypted data stream. Then in step 1922 theencrypted data stream is transformed into an analog transmit signal. Theprocess then ends at step 1930.

If, in step 1902, it is decided not to use the encryption block (or anyother block in the transmit chain) and instead to use the decryptionblock (or any other block in the receive chain) the process moves tostep 1903 in which a received analog signal is transformed into thereceived encrypted data stream. Next, the process moves to step 1905 ofdecrypting the received encrypted data stream into a received decrypteddata stream. In step 1907, a randomness inspection is conducted thatincludes step 1909 of accessing the received decrypted data stream andthe received encrypted data stream and step 1911 of determining arandomness gain by comparing a first randomness measurement associatedwith the received decrypted data stream to a second randomnessmeasurement associated with the received encrypted data stream. Theprocess then ends at step 1930.

FIG. 4 is a diagram of an input data stream generator 400 according toaspects of the invention. As seen in FIG. 4 , there is input data files404 which represent various types of files or data that can be used tocreate digital data streams. Such files/data may be, for example, a pdffile 406, a word processing document 408, a music file (e.g., MP3, etc.)410, and image file 412, or any other type of file 414. Each type offile is processed by a binary conversion module 416 to provide acorresponding binary data stream S_(ix) where i denotes that this is aninput stream and x denotes the original file type i.e., pdf, worddocument, audio, image, or any other correlated data file orpseudorandom generated file. The data stream S_(ix) can be, for example,the input data stream S_(ix) of encryptor 204 of FIG. 2 , or input datastream S_(ix) of comparator 304 in randomness inspector 300 of FIG. 3 .

FIG. 5 is a top-level diagram of a randomness amplifier according toaspects of the invention. Randomness amplifier 502 in FIG. 5 is asymbolic representation of an encryption testing system in which aninput data stream S_(ix) is provided to randomness amplifier 502 whichapplies an encryption method or technique thereby generating arandomness enhanced output data stream S_(ox) and in which randomnessamplifier 502 conducts a randomness comparison between the input datastream S_(ix) and the output data stream S_(ox) to obtain a randomnessgain (|R_(GAIN)|) value (represented by the arrow in FIG. 5 ). The|R_(GAIN)| value is a measure of the randomness applied by theencryption method or technique to the input data stream S_(ix) togenerate the output data stream S_(ox).

The randomness amplifier 502 may be used to test component levelcryptographic security of an encryption method, circuit, or scramblingsystem. In an aspect, randomness amplifier (Ramp) 502 is arepresentation of a system, device, or method that does encryption orscrambling of any form of digitized data at any communication layer of anetwork protocol stack, and determines an |R_(GAIN)| value related tothe encryption or scrambling. Randomness amplifier 502, therefore, takesan input digitized signal or data stream (such as data stream S_(ix)generated by input data stream generator 400 of FIG. 4 ) as an inputhaving a randomness value of R₁ and amplifies or enhances its randomnessvalue by doing encryption or scrambling on the input data stream andproduces a randomized output stream with a randomness value of R_(o).The |R_(GAIN)| value of a randomness amplifier defines the amount ofrandomness that is applied, by a Randomness Amplifier, of to an inputdata stream.

The encryption and/or scrambling methods used in randomness amplifier502, could take various forms (“instances”) in different methods andembodiments such as, but not limited to, an S-box, a mangling function,a rounds-logic and a key expansion module or any other informationscrambling system at any layer of a network protocol stack. In each ofthese forms, the randomness amplifier takes an input stream and appliesits encryption and/or scrambling method to produce a cipher stream byenhancing the randomness value of input stream by a measure defined asthe randomness gain |R_(GAIN)|. The higher the value of |R_(GAIN)| of arandomness amplifier, the more cryptographically strong cipher(encrypted output data stream) it can produce.

FIG. 6 is a functional block diagram of randomness amplifier 600 (suchas randomness amplifier 502 of FIG. 5 ). As seen in FIG. 6 , randomnessamplifier 600 includes randomness enhancer 604 and randomness comparator603. Randomness comparator 603 includes randomness evaluator 606 (twoinstances), memory 608, memory 610 and R_(GAIN) meter 612. In an aspect,the randomness enhancer 604 takes an input digital data stream (S_(ix))and encrypts it using an encryption method and produces a cipher outputdata stream (S_(ox)). The output of randomness enhancer 604 is given toa first instance of randomness evaluator 606, and the input data stream(S_(ix)) is also provided to a second instance of randomness evaluator606. In an aspect, randomness evaluator 606 applies one or moredifferent randomness test suites (like the NIST Test suite), or one ormore component randomness tests thereof, and stores the results of therandomness tests (for example a p-value for each test) of the inputstream (S_(ix)) in Memory_(i) 610. Similarly, randomness evaluator 606applies one or more different randomness test suites (like the NIST Testsuite), or one or more component randomness tests thereof, and storesthe results of the randomness tests (for example a p-value for eachtest) of the output stream (S_(ox)) in Memory_(o) 608. In bothinstances, randomness evaluator 606 also stores a representation of acount of how many tests have failed into the respective memory. R_(GAIN)meter 612 reads the randomness test results stored in Memory_(i) 610 andMemory_(o) 608 and computes a randomness gain (R_(GAIN)) applied byrandomness enhancer 604.

FIG. 20 is a flowchart depicting a process for a randomness amplifieraccording to an aspect. As seen in FIG. 20 , the process begins at step2001 in which an encryption block is applied to an input data stream togenerate an encrypted data stream. In step 2002, at least one randomnessevaluator applies at least one randomness test block to the input datastream to determine a first randomness measurement and applies the atleast one randomness test block to the encrypted data stream todetermine a second randomness measurement. In step 2003, a gain meterdetermines a randomness gain by comparing the first randomnessmeasurement associated with the input data stream to the secondrandomness measurement associated with the encrypted data stream. Theprocess then ends at step 2005.

FIG. 22 is a flowchart depicting a process for a randomness amplifierthat can accept inputs for determining a randomness gain for datastreams associated with any one of a plurality of encryption blocks (ordecryption blocks) in a network stack according to an aspect. As seen inFIG. 22 , the process begins at step 2201 in which a randomness enhancer(such as randomness enhancer 604 of FIG. 6 ) applies one of a pluralityof encryption blocks to an input data stream to generate an encrypteddata stream. As mentioned above, the applied encryption block can be,for example, any encryption block in a circuit (such as BBP 200 of FIG.2 ) or a network stack. Next, in step 2202, at least one randomnessevaluator applies at least one randomness test block to the input datastream to determine a first randomness measurement and also applies theat least one randomness test block to the encrypted data stream todetermine a second randomness measurement. In step 2203, a randomnessgain meter determines a randomness gain by comparing the firstrandomness measurement associated with the input data stream to thesecond randomness measurement associated with the encrypted data stream.The process then ends at step 2205.

FIG. 23 is a flowchart depicting a process for a randomness comparatorthat determines a randomness gain based on any two of a plurality ofdata streams according to an aspect. For example, the plurality of datastreams can include at least two input data streams and at least twooutput encrypted data streams from any location in an encryption orscrambling circuit, such as for example in a baseband processor. As seenin FIG. 23 , the process begins at step 2301 in which at least onerandomness evaluator applies at least one randomness test block to afirst one of the plurality of data streams to determine a firstrandomness measurement. In step 2302, the at least one randomnessevaluator applies the at least one randomness test block to a second oneof the plurality of data streams to determine a second randomnessmeasurement. Next, in step 2303, a randomness gain meter that determinesa randomness gain by comparing the first randomness measurement to thesecond randomness measurement. The process then ends at step 2305.

FIG. 7 is a functional block diagram of randomness enhancer 604 of FIG.6 . In FIG. 7 , randomness enhancer 604 is shown to have the capabilityto include one or more types of encryption or scrambling methods whichcan be applied to an input data stream S_(ix) at any granularity levelon any communication layer of a network protocol stack, or at any stageor block of an encryption circuit. For example, if an instance ofrandomness enhancer 604 utilizes only the S-box 706 of an encryptionmethod then the randomness gain in the generated output data streamS_(ox) is representative of the strength of S-box 706. If instead aninstance of randomness enhancer 604 utilizes a mangling function with around logic around it, such as 1 Round 708 or n Rounds 710, then therandomness gain in the generated output data stream S_(ox) isrepresentative of the cryptographic strength of 1 Round 708 (or n Rounds710) of an encryption method. Similarly, if an instance of randomnessenhancer 604 utilizes a complete encryption method (CA) with the keyscheduling module 712 then the randomness gain in the generated outputdata stream S_(ox) is representative of the strength of the completemethod (CA) 712. Another instance of randomness enhancer 604 may utilizedata scrambler 714 at the physical layer. The randomness gain applied bydata scrambler 714 is not only representative of its cryptographicstrength but also benchmarks its strength against other known strongencryption methods such as like the Advanced Encryption Standard (AES).It should be appreciated that encryption components 706 to 714 ofrandomness enhancer 604 are examples, and that randomness enhancer 604can include one or more components of any known encryption methods ortechniques. Randomness enhancer 604 can also assign a sensitivity levelto a particular instance of the type of encryption component(s) utilizedthat depicts the catastrophic level of information security compromiseif it should fail one or more randomness tests in the NIST suite. Forexample, the lowest sensitivity level may be assigned to S-box 706 andthe highest sensitivity level may be assigned to the complete encryptionmethod (CA) 712. The penalty value (T_(Value)) output by randomnessevaluator 606 in FIG. 6 may be proportional to the assigned sensitivitylevel of the particular instance of randomness enhancer 604.

FIG. 8 shows a functional block diagram of randomness evaluator 606 ofFIG. 6 . As seen in FIG. 8 , randomness evaluator 606 includes arandomness test suite 804 of various randomness tests 806 to 834, whichmay be similar to the proposed NIST test suite, or any other knownrandomness test suites, or components thereof. It should be appreciatedthat randomness test suite 804 can be generalized to any randomness testsuite by extending or reducing the number of randomness tests containedtherein. The generalized test suite can be enhanced by adding any newrandomness test or any new randomness test suites. Moreover, randomnessevaluator 606 could use any other known randomness test that is deemeduseful in any applied instance of randomness evaluator 606. Inrandomness test suite 804, the NIST test suite is used as an example andis composed of 15 randomness test modules 806 to 834. Randomnessevaluator 606 applies each randomness test to input data stream S_(ix)and computes a normalized statistical value (p-value) of each randomnesstest result on the basis of its corresponding randomness measure. Inthis example, the statistical p-value of a randomness test is used asthe normalized statistical value. The p-value varies between 0.0 and 1.0where 0.0 shows a perfectly correlated data stream and 1.0 shows aperfect pseudo random cipher stream. This calculation method ispresented as an example only and it should be appreciated thatrandomness evaluator 606 could also use any known suitable normalizedmethod to determine the randomness test result. A brief description ofthe 15 randomness tests of randomness test suite 804 is provided below.

1. Frequency Test (F) 806. The purpose of this test is to determinewhether a randomness enhancer is able to ensure that the number of onesand zeros in the substituted cipher stream are approximately the same aswould be expected in a random cipher. Its randomness measure is denotedby RM_(F). Its normalized statistical value is denoted by p₁.

2. Block Frequency Test (BF) 808. The aim of this test is to ensure thata randomness enhancer is able to maintain the notion of randomness—equalnumber of ones and zeros—even in small, substituted blocks of a givenlength M. Its randomness measure is denoted by RM_(B). Its normalizedstatistical value is denoted by p₂.

3. Runs Test (Rn) 810. The purpose of this test is to determine whethera randomness enhancer is able to maintain the required oscillation speedbetween variable length k continuous ones and zeros. The test identifieswhether the transitions between such zeros or ones is too slow or toofast. Its randomness measure is denoted by RM_(R). Its normalizedstatistical value is denoted by p₃.

4. Longest Run of Ones in a Block Test (LR) 812. The purpose of thistest is to determine whether a randomness enhancer is able to limit thelongest run of ones within M block bits in such a fashion as expected ina random bit stream. Consequently, if the longest run of ones isirregular, the same would hold for zeros. Its randomness measure isdenoted by RM_(L). Its normalized statistical value is denoted by p₄.

5. Binary Matrix Rank Test (Rk) 814. The purpose of this test is toensure that whether a randomness enhancer should not introduce a lineardependence among fixed length disjoint sub matrices of the entire cipherbit stream. Its randomness measure is denoted by RM_(K). Its normalizedstatistical value is denoted by p₅.

6. Discrete Fourier Transform Test (DFT) 816. The purpose of this testis to identify whether a randomness enhancer has introduced periodicfeatures in the cipher bit stream that would indicate a deviation fromassumed randomness. The intention is to detect whether the number ofpeaks, in the Discrete Fourier Transform (DFT) of the cipher bit stream,exceeding the 95% threshold differs significantly by 5%. Its randomnessmeasure is denoted by RM_(D). Its normalized statistical value isdenoted by p₆.

7. Non-Overlapping Test (NO) 818. The purpose of this test is to detectwhether a randomness enhancer has generated too many occurrences of agiven non-periodic patterns of an m-bit window. For p-value<0.01, itindicates that the cipher stream has irregular occurrences of thepossible template patterns. Its randomness measure is denoted by RM_(N).Its normalized statistical value is denoted by p₇.

8. Overlapping Test (Ov) 820. The purpose of this test is same as for NOtest, but the difference is that in NO test, if the pattern is notfound, the window slides one-bit position. But in this test, if thepattern is found, window slides on bit position before resuming thesearch. Its randomness measure is denoted by RM_(O). Its normalizedstatistical value is denoted by p₈.

9. Universal Statistical Test (US) 822. The purpose of the test is todetect whether or not the cipher stream can be compressed without lossof information. A significantly compressible sequence is considered tobe non-random. Its randomness measure is denoted by RM_(U). Itsnormalized statistical value is denoted by p₉.

10. Linear Complexity Test (LC) 824. The purpose of this test is todetermine randomness, introduced by a randomness enhancer, in the cipherstream by computing the length of Linear Feedback Shift Register (LFSR).Longer LFSR characterizes a random sequence. Its randomness measure isdenoted by RM_(C). Its Normalized Statistical value is denoted by p₁₀.

11. Serial Test (SE) 826. The purpose of this test is to determinewhether the number of occurrences of the 2m m-bit overlapping patternsis approximately the same as would be expected for a random sequence.The random sequence is expected to have uniformity; all m-bit patternshave equal chances to appear in the cipher. Its randomness measure isdenoted by RM_(T). Its normalized statistical value is denoted by p₁₁.

12. Cumulative Sum Test (CS) 828. The purpose of this test to checkwhether the cumulative sum of partial sequences is too small or large.For a random sequence, the CS should be near zero. For nonrandomsequence, the CS will be large. Its randomness measure is denoted byRM_(S). Its normalized statistical value is denoted by p₁₂.

13. Approximate Entropy Test (AE) 830. The purpose of this test is todetermine whether a randomness enhancer has introduced overlappingm-bits patterns in the substituted cipher stream. A large frequency ofconsecutive m and m+1 length block represents a deviation from thenotion of randomness. Its randomness measure is denoted by RM_(A). Itsnormalized statistical value is denoted by p₁₃.

14. Random Excursion Test (RE) 832. The purpose of this test is todetermine if the number of visits to a particular state within a cycleconsisting of a sequence of steps of unit length taken at random in sucha fashion that one returns to the origin—deviates from what one wouldexpect for a random sequence. In this test, (0,1) is transformed to (−1,+1) and then the number of visits to −4, −3, −2, −1, and +1, +2, +3 and+4 are calculated; as a result, we get 8 randomness measure valuescorresponding to each state. To simplify analysis, the module selectsthe minimum among them. Its randomness measure is denoted by RM_(E). Itsnormalized statistical value is denoted by p₁₄.

15. Random Excursion Variant Test (REV) 834. The purpose of this test isto determine the number of times a particular state is visited incumulative sum random walk and then conclude whether it deviates fromthe random walk. This test consists of a series of 18 tests and produces18 randomness values. The module again picks up the minimum one amongthem to simplify the analysis. Its randomness measure is denoted byRM_(V). Its normalized statistical value is denoted by p₁₅.

Randomness evaluator 606 also determines whether a randomness test hasfailed at decision block 844 and maintains a dynamic counter 842 that isinitialized to zero for each data stream and is incremented by 1whenever any individual randomness test of randomness test suite 804fails. In this regard, if an entire encryption algorithm is currentlybeing tested and the counter is non-zero it means that the entireencryption algorithm has failed at least one test of the randomness testsuite and therefore the entire encryption algorithm is compromised orinadequate. Alternatively, if only a component of an entire encryptionalgorithm is being tested and the counter is non-zero it means that theencryption component currently being tested has failed at least one testof the randomness test suite, but it does not necessarily mean that theentire encryption algorithm is compromised or inadequate. In the lattercase, further testing of the components of the entire encryptionalgorithm is necessary to determine whether the entire encryptionalgorithm is compromised or inadequate. Counter 842 outputs the countervalue for subsequent use in a penalty function. Finally, the 15normalized statistical values (p-values) and the counter 842 valuecorresponding to an input data stream S_(ix) are stored through MUX 846in Memory 850. Referring to FIG. 6 , the normalized statistical values(p-values) and the counter value corresponding to an input data streamS_(ix) given to randomness enhancer 604 are stored in memory 610, andthe normalized statistical values (p-values) and the counter valuecorresponding to output data stream S_(ix) of randomness enhancer 604are stored in memory 608.

FIG. 9 is a functional block diagram of R_(GAIN) Meter 612 of FIG. 6 inwhich. R_(GAIN) meter 612 computes the R_(GAIN) of randomness enhancer604 where its input data stream is S_(ix) and its cipher output datastream is S_(ox).

As seen in FIG. 9 , R_(GAIN) meter 612 is composed of Σ_(GAIN) meter912, π_(GAIN) meter 918 and aggregator module 930. Both meters 912 and918 read the p-values and counter values 904 and 906 stored byrandomness evaluator 606 both for input and output data streams inmemories 908 and 910, respectively. Σ_(GAIN) meter 912 includesΣ_(Model) 914 and also a penalty value block 916 that applies a penaltyfunction to the counter value to generate a penalty value (T_(value))corresponding to the sensitivity level of the instance of randomnessenhancer 604 and then finally computes Σ_(GAIN) based on the output ofImai 914 and penalty value block 916. With regard to penalty value block916, in case that an instance of randomness enhancer 604 utilizes S-box706, it is highly likely that some tests of randomness test suite 804might fail and therefore only a smaller penalty value T_(value) isgenerated. On the other hand, in case that an instance of randomnessenhancer 604 utilizes 1-round 708 or n rounds 710 of an encryptionmethod and they still fail a randomness test, then a higher penaltyvalue T_(value) is generated because after n rounds an encryption methodmay not be expected to still fail any randomness test of randomness testsuite 804. Both meters 912 and 918 take log₂ of determined randomnessgain (R_(GAIN)) and then scale it by multiplying with k to result inscale values that provide better insights into randomness gain behaviorof a randomness enhancer 604. In one instance, k is set to a value of 8in order to provide differentiating behavior analyses. In otherinstances, k might take a value of 16 or 32 or any power of 2 thatprovides better insight into randomness gain behavior.

An example embodiment of Σ_(Model) 914 is the following mathematicalmodel, but it could generalize to be any other appropriate mathematicalor heuristic model or method.

$\sum_{MODEL}{= {k \times {\log_{2}\left( {\frac{1}{N}{\sum\limits_{j = 1}^{N}\frac{p_{j}^{out}}{p_{j}^{in} + 0.01}}} \right)}}}$PenaltyValue = T_(value) ∑_(GAIN) = ∑_(MODEL)+PenaltyValue$\sum_{GAIN}{= {{k \times {\log_{2}\left( {\frac{1}{N}\ {\sum\limits_{j = 1}^{N}\frac{p_{j}^{out}}{p_{j}^{in} + 0.01}}} \right)}} + T_{value}}}$

where N is the number of tests in randomness test suite 804, p_(j)^(out) is the p-value of the test applied on output data cipher streamproduced by an instance of randomness enhancer 604 and p_(j) ^(in) isthe p-value of the test j applied on an input data stream given to arandomness enhancer 604 and T_(value) is a penalty value computed bypenalty value block 916 by applying a penalty function of the form[k×log₂(λp)×counter] where counter 842 is the number of tests failed andλ_(p) is chosen such that a penalty value proportional to thesensitivity level of randomness enhancer 604 is computed. In thisregard, λ_(p) is constrained to a value between 0 and 1, which resultsin the penalty value T_(value) always being a negative value. ΣGAINmeter 912 adds 0.01 value to p_(j) ^(in) to avoid divide-by-zeroexception and to cap the upper limit of scaled values where p_(j) ^(in)are very small. ΣGAIN computed by ΣGAIN meter 912 provides an upperlimit on R_(GAIN) (randomness gain) because it takes an arithmeticaverage of component gains of all test results of tests 806 to 834 ofrandomness test suite 804. Another example embodiment of ΣMeter 912 is:

$\sum_{GAIN}{= {{k \times \left( {\frac{1}{N}{\sum\limits_{j = 1}^{N}\frac{p_{j}^{out}}{p_{j}^{in} + 0.01}}} \right)} + T_{value}}}$

Another example embodiment is:

$\sum_{GAIN}{= {{k \times \left( {{\frac{1}{N}{\sum\limits_{j = 1}^{N}p_{j}^{out}}} - p_{j}^{in}} \right)} + T_{value}}}$

πGAIN meter 918 uses a π_(Model) 920 and penalty value block 922(similar to penalty value block 916 described above) that applies apenalty function to the counter value to generate a penalty value(T_(value)) corresponding to the sensitivity level of the embodiment ofrandomness enhancer 604 in order to compute wo v. An example embodimentof the πModel 920 is the following mathematical model, but it couldgeneralize to any other appropriate mathematical or heuristic model ormethod.

$\pi_{GAIN} = {{k \times {\log_{2}\left\lbrack {\prod\limits_{j = 1}^{N}\frac{p_{j}^{out} + 0.1}{p_{j}^{in} + 0.1}} \right\rbrack}^{\frac{1}{N}}} + T_{value}}$

where N is the number of tests in randomness test suite 804, p_(j)^(out) is the p-value of the test j applied on output data cipher streamproduced by an instance of randomness enhancer 604, and p_(j) ^(in) isthe p-value of the test j applied on input data stream given to aninstance of randomness enhancer 604 and T_(value) is a penalty valuecomputed by penalty values block 922 by applying an appropriate penaltyfunction of the form [k×log₂(λ_(p))×counter] where counter 842 is thenumber of tests failed and λ_(p) is chosen such that a penalty valueproportional to the sensitivity level of randomness enhancer 604 iscomputed. In this regard, λ_(p) is constrained to a value between 0 and1, which results in the penalty value T_(value) always being a negativevalue. πGAIN meter 918 adds 0.1 (or any small constant) to p_(j) ^(in)and p_(j) ^(out) to avoid divide-by-zero exception and to cap the upperlimit of scaled values where p_(j) ^(in) are very small. π_(GAIN)computed by π_(GAIN) meter 918 provides a lower limit on R_(GAIN)(randomness gain) because it takes a geometric average of componentgains of the results of all randomness tests 806 to 834 of randomnesstest suite 804.

Another example embodiment of πModel 920 is:

$\pi_{GAIN} = {{k \times \left\lbrack {\prod\limits_{j = 1}^{N}\frac{p_{j}^{out} + 0.1}{p_{j}^{in} + 0.1}} \right\rbrack^{\frac{1}{N}}} + T_{value}}$

Finally, aggregator 930 uses the definition of Arithmetic-Geometric mean(AGM) in one embodiment as an example to provide a representativerandomness gain value between ΣGAIN and π_(GAIN). The output value ofR_(GAIN) from aggregator 930 using the AGM method is:

R _(GAIN)=AGM(Σ_(GAIN),π_(GAIN))

When R_(GAIN) is computed on a logarithm 2 scale and measures therandomness gain (R_(GAIN)) of an instance of randomness enhancer 604 inunits of Octa Bells (octaB) i.e. an increase of 8 octaB represents atwofold enhancement in randomness of a Randomness amplifier. In otherembodiments, Σ_(GAIN) and π_(GAIN) can be aggregated using arithmeticmean, geometric mean, or any known suitable aggregation method.

FIG. 10 is a functional block diagram of randomness scope 1040 thatgenerates plots of RAIN test results of randomness amplifier 600 testsystem of FIG. 6 , for example. Randomness scope 1040 plots R-Curves fordifferent instances (706 to 714) of randomness enhancer 604 which iscomprised of an encryption method or its subcomponents. The testing ofeach encryption component of an encryption method is shown in FIG. 10 asrandomness amplifiers 1012 to 1015, respectively, of Method 1 1010,which generate outputs R_(GAIN11), R_(GAIN12), R_(GAIN13), AndR_(GAIN14). Testing of other Methods 2 to j are represented by othersets (1020, 1030) of randomness amplifiers with their associated outputR_(GAIN) values. Randomness scope 1040 includes R_(GAIN) matrixconvertor 1042 which creates a matrix of l*n*m dimension, where l showsthe number of input data streams provided at the input of randomnessamplifier 600, n shows the number of encryption methods to be comparedand benchmarked, and m shows the number of granularity levels at whichan instance of randomness enhancer 604 within randomness amplifier 600test system is to be tested. The matrix elements for each input datastream is a 2-dimensional submatrix that stores randomness gain(R_(GAIN)) values for each instance (706 to 714) of randomness enhancer604. Max-Min finder 1044 finds the maximum and minimum values of therandomness gains and provides them to Axes Scaling module 1046. R-curveplotter 1048 then generates R-Curve plots 1050 for each differentencryption method by using linear splicing of randomness gainscorresponding to each different encryption method (706 to 714). Theplotted line 1052 of R-Curve 1050 shows the plot of the determinedrandomness gain (R_(GAIN)) corresponding to S-box 706, 1 Round 708, nRounds 710, and Complete Method (CA) 712 of encryption method 1.Similarly, line 1054 of R-Curve 1050 shows the plot of the determinedrandomness gain (R_(GAIN)) corresponding to S-box 706, 1 Round 708, nRounds 710, and Complete Method (CA) 712 of encryption method 2, etc.

FIG. 11 is a functional block diagram of a randomness test system (RTS)1100 for end-to-end testing of encryption methods comprised of differentencryption components and determining R_(GAIN) values for the componentsand outputting plots of the test results. RTS 1100 includes streamgenerator 1104, mode selector 1106, randomness amplifier 1108 andrandomness scope 1110. Stream generator 1104 generates input digitaldata streams in a manner as described above with respect to FIG. 4 andits associated description. Randomness amplifier 1108 applies randomnessto the input digital data stream and tests the output data stream todetermine a randomness gain in a manner as described above with respectto FIGS. 6 to 9 and their associated description. Randomness scope 1110generates plots of the randomness gain test results in a manner asdescribed above with respect to FIG. 10 and its associated description.RTS 1100 provides the ability to conduct randomness testing in differentoperational modes by utilizing mode selector 1106. Example embodimentsof two operational modes are provided in FIG. 5 (correlated randomnessamplifier—CRA mode) and in FIG. 12 (uncorrelated randomnessamplifier—URA mode). Turning to FIG. 5 , an R_(GAIN) meter (such asR_(GAIN) meter 612) of randomness amplifier 502 (CRA mode) computes itsrandomness gain (R_(GAIN)) based on results from a randomness evaluator(such as randomness evaluator 606) of randomness amplifier 502 byapplication of randomness test suite 804 on its output cipher datastream (S_(ox)) and input data stream (S_(ix)). Randomness amplifier 502(CRA mode) provides a lower limit on the randomness gain for acorrelated input data stream because correlated artifacts of the inputdata stream are not subtracted from the output cipher stream. Turning toFIG. 12 , randomness amplifier (URA mode) 1202 shows that the correlatedartifacts of the input data stream are subtracted from the output datastream at junction 1204. As a result, the correlated artifacts of theinput data stream are suppressed and so the cipher output data stream(S_(ox)) now contains only pseudo randomness data stream. This URA modeprovides an upper limit on the randomness gain. An R_(GAIN) meter (suchas R_(GAIN) meter 612) of URA randomness amplifier 1202 computes arandomness gain (R_(GAIN)) based on results from a randomness evaluator(such as randomness evaluator 606) of randomness amplifier 1202 byapplication of randomness test suite 804 on its cipher output datastream (S_(ox)) and input data stream (S_(ix)).

RTS 1100 empowers users and designers of encryption methods to testcomponents of encryption methods by treating components of an encryptionmethod as an instance of a randomness enhancer in randomness amplifier1108 and testing their cryptographic strength by computing an associatedrandomness gain (R_(GAIN)). This unique and novel testing process isreferred to herein as Deep Cipher Investigation (DCI).

In another aspect of the invention, FIG. 13 shows a randomnesscomparator 1300 that is a simplified version of randomness comparator603 of randomness amplifier 600 shown in FIG. 6 . In FIG. 13 ,randomness comparator 1300 has two input data streams S_(in) and S_(ib),respectively and provides them to randomness evaluators 1310 and 1314,respectively. The functionality of randomness evaluators 1310 and 1314is the same as that described above with respect to randomness evaluator606 of FIGS. 6 and 8 . In randomness comparator 1300, once R_(GAIN)meter 1320 computes the randomness gain (R_(GAIN)) by considering one ofthe streams as an input stream and the other as an output stream, thendue to logarithm scale, it is actually computing the randomness distancewhich effectively models the difference in their randomness values.Finally, R_(GAIN) meter 1320 takes the modulus to show randomnessdistance measure between the two streams. Accordingly, randomnesscomparator 1300 makes it possible to measure the closeness of twostreams in the randomness space. The smaller the randomness distance,the closer are two streams in the randomness space and vice versa.

In another aspect, FIG. 14 is a block diagram of randomness inspector1400 which benchmarks the R_(GAIN) of an instance of a randomnesscomparator 1404 against a standard randomness amplifier 1402, such as anAES model instance of a randomness amplifier. Randomness inspector 1400uses difference calculator 1406 to benchmark the output R_(GAIN) of therandomness comparator 1404, which may be coupled to an encryptor blockin a BPP for example, against the output R_(GAIN) of the AES modelamplifier 1402. Randomness inspector 1400 selects from two sets ofinputs (for example, inputs from either a transmit chain or a receivechain of a BPP). In FIG. 14 , two data streams S_(ix) and S_(ox) from anencryptor block and two data streams S_(ix) and S_(ox) from a decryptorblock are provided to switch 1401. Similar to switch 302 of FIG. 3 ,switch 1401 can be located in Randomness Inspector 1400 or can belocated outside of Randomness Inspector 1400, such as in a separatecomponent or function of a circuit in which Randomness Inspector 1400resides, such as for example in BBP 200 shown in FIG. 2 . Switch 1401can be implemented in a circuit, logic, or other known means.Alternatively, switch 1401 may be optional in the case that RandomnessInspector 1400 is configured to only accept inputs from an encryptorblock (such as in the transmit chain of BBP 200) or to only acceptinputs from a decryptor block (such as in the receive chain of BBP 200).An Input Mode Flag is also provided to switch 1401 which instructsswitch 1401 whether to use the data streams S_(ix) and S_(ox) from theencryptor block or from the decryptor block and then output them asselected data streams S_(ix) and S_(ox) to randomness comparator 1404and AES model amplifier 1402. If the difference (Δ) determined bydifference calculator 1406 between the randomness gains of the tworandomness amplifiers (the first amplifier being randomness comparator1404 coupled to an encryptor, and the second amplifier being the AESmodel amplifier) is more than a threshold (δ), then it is determinedthat the encryptor associated with randomness comparator 1404 is eitherdisabled or severely compromised. In such a state of disablement orcompromise, a system controller could be enabled to take appropriatesteps to mitigate the adverse effects of this type of security problemwith the compromised encryptor.

FIG. 21 is a flowchart depicting a process for a benchmarked randomnessamplifier according to an aspect. As seen in FIG. 21 , the processbegins at step 2101 in which a randomness amplifier receives a firstinput data stream as an input. Next, in step 2102, the randomnessamplifier applies a standard encryption block to the first input datastream to generate a standard encrypted data stream. In step 2103, therandomness amplifier determines a first randomness gain by comparing afirst randomness measurement associated with the first input data streamto a second randomness measurement associated with the standardencrypted data stream. The process then moves to step 2104 in which arandomness comparator receives the first input data stream and a secondencrypted data stream as inputs, the second encrypted data stream beinggenerated by application of a second encryption block to the first inputdata stream. In step 2105, the randomness comparator determines a secondrandomness gain by comparing the first randomness measurement associatedwith the first input data stream to a third randomness measurementassociated with the second encrypted data stream. In step 2106, adifference calculator determines a randomness gain difference bycomparing the first randomness gain to the second randomness gain. Theprocess then ends at step 2107.

FIG. 15 depicts a block diagram of a baseband processor (BBP) 1500suitable for different types of radios and FOC systems, wherein the BBPincludes a randomness inspector 1526 having switchable inputs accordingto an aspect of the invention. BBP 1500 is similar to BBP 200 of FIG. 2, except that randomness inspector 1526 of BBP 1500 has the capabilityto switch inputs in order to test the encryption strength of differentblocks in the chain of BBP 1500. BBP 1500 includes, but is not limitedto, encryptor 1504, channel selection 1506, spreader 1508, serializer1510, and modulator 1512 in the transmit chain. As seen in FIG. 15 ,transmit data 1502 is input into BBP 1500 and is processed by blocks1504 to 1512 to output modulated data to DAC 1514 to create an analogoutput signal. The receiver chain includes demodulator 1532,deserializer 1534, despreader 1536, channel selection 1538 and decryptor1540. In the receiver chain of FIG. 15 , an analog signal-in is input toADC 1530 which outputs modulated data to BBP 1500 which processes it inblocks 1532 to 1540 to generate decrypted received data 1542.

According to an aspect of the invention, randomness inspector 1526computes the randomness distance of any two serial or parallel data bitdata streams at any time and at various locations in BPP 1500 to findout whether the encryption method has been compromised or disabled, suchas by an adversary attack on the channel. In case of a security breach,BPP 1500 can alert the system to take appropriate security mitigationcountermeasures. Randomness inspector 1526 can be implemented usingexisting resources in BPP 1500 or in a dedicated hardware and can berealized within the baseband processor chip or a separate dedicatedchip.

As seen in FIG. 15 , the data stream for investigation can be the tappedfrom the input or output of blocks 1504, 1510 or 1512 to determine aproblem or compromise in the encryption provided by that particularblock (the location), and the severity and the type of an adversaryattack. An encryption investigation can be applied on the whole band, asub-band, a complete channel of the sub channels of the TDMA and FDMA.CDMA or spread spectrum systems.

In the case that the gNB or the UE is under attack and the cryptographicstrength of an encryption method is compromised or the encryption moduleis bypassed, such an attack can be detected by connecting the inputS_(ix) and output S_(ox) of encryptor 1504 to the two of the inputsS_(ix) and S_(ox) of randomness inspector 1526, respectively. The S_(ix)input of randomness inspector 1526 may be tied to the data stream whichis under investigation though memory 1522 and switch 1524. As discussedabove, |R_(GAIN)| values computed inside the randomness inspector 1526determine the randomness distance between input and output data streams.The determined |R_(GAIN)| and both the input S_(ix) and the outputS_(ox) can be used directly or stored in memory 1522 for a later use.

FIG. 16 depicts a functional block diagram of randomness inspector 1600,such as randomness inspector 1526 of FIG. 15 , having switchable inputs.The switchable inputs can be from, for example, any block in thetransmit chain or any block in the receive chain of BPP 1500 shown inFIG. 15 (or BBP 200 of FIG. 2 ). Randomness inspector 1600 includes tworandomness comparators 1602 and 1604 and a difference calculator 1606which calculates the difference (Δ) in the |R_(GAIN)| determined by eachof the randomness comparators 1602 and 1604. If the difference (Δ) inthe two |R_(GAIN)| values is less than a predetermined threshold (δ), itis determined that the two data streams are very close in randomnessspace. In FIG. 16 , randomness comparator 1602 has inputs S_(ix) whichis an input data stream before encryption and S_(ox) which is an outputdata stream after encryption. Randomness comparator 1602 determines therandomness gain |R_(GAIN)| between the S_(ix) and S_(ox) data streamswhich is an indication of the strength of the encryption applied toS_(ix) to thereby result in S_(ox). Randomness comparator 1604 hasinputs S_(ix) which is the input data stream before encryption andS_(jx) which is a data stream after a subsequent level of encryption atanother block location in an encryption circuit, such as BPP 1500.Randomness comparator 1604 determines the randomness gain |R_(GAIN)|between S_(ix) and S_(jx) which is an indication of the strength of thesubsequent level of encryption applied to thereby result in S_(jx). Asseen in FIG. 16 , data stream S_(jx) may be selected, such as by aswitch, from a variety of data streams in an encryption chain or circuitsuch as, for example, data streams S^(I) _(oy), S^(Q) _(oy), S^(I)_(oz), and S^(Q) _(oz), which represent output data streams fromdifferent locations in an encryption chain or circuit. In an aspect,randomness comparators 1602 and 1604 determine the randomness gain|R_(GAIN)| by applying a randomness evaluator to each of the input datastreams to the comparator as described above with respect to randomnessevaluator 606 in FIGS. 6 and 8 .

Returning to FIG. 15 , if encryptor 1504 is enabled, then |R_(GAIN)| ofrandomness comparator 1602 inside the randomness inspector 1526 shouldcorrespond to a high randomness distance between the two data streams;otherwise, encryptor 1504 degrades to ILLUZIJA (a fake encryptor) andsuch a compromise is easily detected by randomness inspector 1526. Anundetected ILLUZIJA attack could significantly reduce the cryptographicstrength of cipher output data stream S_(ox) and therefore lead to asecurity breach of the information in output data stream S_(ox).

If encryptor 1504 is not disabled, there is still a possibility thatserializer 1510 or modulator 1512 might have been the target of anattack to degrade the cryptographic strength of cipher output streamS_(ox). In order to detect that blocks 1510 or 1512 are under attack,any suspected compromised data stream from the I or Q channel before orafter modulation (S^(I) _(oy), S^(Q) _(oy), S^(I) _(oz), and S^(Q)_(oz)) is fed to the S_(jx) input of the randomness inspector 1526 alongwith the input data stream S_(ix) and the output data stream S_(ox) ofencryptor 1504 to their respective inputs S_(ix) and S_(ox) ofrandomness inspector 1526. The output of randomness inspector 1526 is arandomness distance measure (Δ) between the reference stream (S_(ix))and the data stream S_(jx) under investigation (S^(I) _(oy), S^(Q)_(oy), S^(I) _(oz), S^(Q) _(oz)). If the difference (Δ) between the twodata streams is more than a threshold (δ), then it is determined thatthe block in the system under investigation is has been compromised. Insuch a compromised situation, the system controller may be enabled totake the appropriate steps to mitigate the adverse effects of thedetected type of security attack or compromise.

According to certain above-described aspects and the accompanyingfigures, a randomness inspector is provided in an encryption circuit,such as a BPP for example, which can test data streams at differentlocations in the circuit to determine the encryption strength of one ormore components of the encryption circuit, and also to thereby determineif one or more of the components is disabled or compromised.

In another aspect, FIG. 17 is a block diagram of differential randomnesscomparator 1702 which benchmarks the R_(GAIN) of an instance of onestandard randomness amplifier 1704, such as an AES model, a MARS model(a known shared-key (symmetric) block cipher), or other known standardencryption or scrambling model instance of a randomness amplifier,against a second randomness amplifier 1706, such as a selectable orprogrammable encryption model instance of a randomness amplifier,thereby determining whether a pattern of differential behavior existsbetween standard randomness amplifier 1704 and selected/programmedrandomness amplifier 1706, and also to thereby determine whetherdifferential attacks are possible on either of randomness amplifiers1704 and 1706. In this manner, selected/programmed randomness amplifier1706 (which may apply an encryption model or algorithm underinvestigation or analysis) can be benchmarked against standardrandomness amplifier 1704. Differential randomness comparator 1702stores R_(GAIN) values of S-box 1714, 1 Round 1716, n Rounds 1718 andComplete Method 1720 variants of Randomness Amplifier 1704 in Memory1708, and similarly, Differential randomness comparator 1702 storesR_(GAIN) values of S-box 1724, 1 Round 1726, n Rounds 1728 and CompleteMethod 1730 variants of Randomness Amplifier 1706 in Memory 1710. Anapparatus Randomness Scope 1732 reads the plurality of randomness gainvalues of the different variants of the two compared randomnessamplifiers from Memories 1708 and 1710, respectively, and then plotsR-Curves (1734, 1736 and 1738) of the two benchmarked randomnessamplifiers and ILLUIZJA (a fake encryptor) on its randomness distancescreen (with a logarithm display). A designer or analyst of anencryption circuit can select between Single Mode 1740 and Overlay Mode1742 to choose between seeing the R-Curve of only one randomnessamplifier or a plurality of more than one R-Curves, respectively. Thedesigner or analyst of an encryption circuit or system or method canalso choose to benchmark S-box only, 1 Round only, n Rounds only orComplete Method variants of two randomness amplifiers by pressing S-boxbutton 1744, 1 Round button 1746, n Rounds button 1748 or CompleteAlgorithm button 1750, respectively. If the randomness gain difference(Δ) between the randomness gains of the two randomness amplifiers (forexample, the first amplifier 1704 being coupled to an encryptor, and thesecond amplifier 1706 being coupled to an encryptor) is more than athreshold (δ), then it is determined that one or more of the encryptorcircuits or systems or algorithms are in a compromised state and may bevulnerable and susceptible to differential attacks that eventually maybe exploited by adversaries. R-Curves 1734, 1736 and 1738 represent theresults of three different randomness amplifiers, respectively, where1738 is an R-Curve of ILLUZIJA. R-Curves 1734 and 1736 on RandomnessScope 1732 show that both randomness amplifiers 1704 and 1706 arevulnerable to differential analysis attacks once their randomness gainsare analyzed using this unique and novel process of Deep CipherInvestigation (DCI). In such a state of compromise, encryption circuitdesigners could be enabled to take appropriate steps to mitigate theadverse effects of this type of security problem with the encryptorassociated with each compromised randomness amplifier.

FIG. 24 is a flowchart depicting a process for a differential randomnesscomparator according to an aspect. For example, the differentialrandomness comparator can determine a randomness gain difference betweena first randomness gain associated with a first randomness amplifier anda second randomness gain associated with a second randomness amplifier.As seen in FIG. 24 , the process begins at step 2401 in which a firstrandomness amplifier receives a first input data stream as an input. Instep 2402, the first randomness amplifier applies a first encryptionblock to the first input data stream to generate a first encrypted datastream. Next, in step 2403, the first randomness amplifier determines afirst randomness gain by comparing a first randomness measurementassociated with the first input data stream to a second randomnessmeasurement associated with the first encrypted data stream. The processthen proceeds to step 2404 in which a second randomness amplifierreceives a first input data stream as an input. In step 2405, the secondrandomness amplifier applies a second encryption block to the firstinput data stream to generate a second encrypted data stream. Next, instep 2406, the second randomness amplifier determines a secondrandomness gain by comparing the first randomness measurement associatedwith the first input data stream to a third randomness measurementassociated with the second encrypted data stream. In step 2407, adifference calculator determines a randomness gain difference bycomparing the first randomness gain to the second randomness gain. Theprocess then ends at step 2410.

FIG. 25 is a flowchart depicting a process for a randomness scopeaccording to an aspect. For example, the randomness scope can compare afirst set of randomness gain values associated with a first randomnessamplifier to a second set of randomness gain values associated with asecond randomness amplifier. As seen in FIG. 25 , the process begins atstep 2501 in which an input section accesses the first set of randomnessgain values from a first memory, the first set of randomness gain valuesincluding a separate randomness gain value generated by the firstrandomness amplifier using each one of a plurality of differentencryption component blocks. Next, in step 2502, the input sectionaccesses the second set of randomness gain values from a second memory,the second set of randomness gain values including a separate randomnessgain value generated by the second randomness amplifier using each oneof the plurality of different encryption component blocks. In step 2503,a randomness curve generator generates a first set of randomness curvesassociated with the first set of randomness gain values and a second setof randomness curves associated with the second set of randomness gainvalues. In step 2504, a randomness distance display is used to displayany of the first set of randomness curves and any of the first set ofrandomness curves based on one or more randomness curve selection inputsfrom a user interface, wherein at least one randomness curve selectioninput is associated with one of the plurality of different encryptioncomponent blocks. The process then ends at step 2510.

FIG. 18 is top-level diagram of a differential randomness comparatorwith two randomness amplifiers in which correlated artifacts aresubtracted from the output stream. As seen in FIG. 18 , a differentialrandomness comparator 1802 is provided which benchmarks the R_(GAIN) ofan instance of one standard randomness amplifier 1804, such as an AESmodel, a MARS model (a known shared-key (symmetric) block cipher), orother known standard encryption or scrambling model instance of arandomness amplifier, against a second randomness amplifier 1812, suchas a selectable or programmable encryption model instance of arandomness amplifier, thereby determining whether a pattern ofdifferential behavior exists between randomness amplifier 1804 andselected/programmed randomness amplifier 1812, and also to therebydetermine whether differential attacks are possible on either ofrandomness amplifiers 1804 and 1812. In this manner, selected/programmedrandomness amplifier 1812 (which may apply an encryption model or methodunder investigation or analysis) can be benchmarked against standardrandomness amplifier 1804. In differential randomness comparator 1802,correlated artifacts are subtracted from the output streams ofrandomness amplifier 1804 and randomness amplifier 1812 at junctions1806 and 1814, respectively. Differential randomness comparator 1802stores R_(GAIN) values of S-box 1821, 1 Round 1822, n Rounds 1823 andComplete Method 1824 variants of Randomness Amplifier 1804 in Memory1810, and similarly, Differential randomness comparator 1802 storesR_(GAIN) values of S-box 1831, 1 Round 1832, n Rounds 1833 and CompleteMethod 1834 variants of Randomness Amplifier 1812 in Memory 1816.Randomness Scope 1850 reads the plurality of randomness gain values ofthe different variants of the two compared randomness amplifiers fromMemories 1810 and 1816, respectively, and then plots R-Curves (1851,1852 and 1853) of the two benchmarked randomness amplifiers and ILLUIZJA(a fake encryptor) on its randomness distance screen. A designer oranalyst of an encryption circuit can select between Single Mode 1840 andOverlay Mode 1842 to choose between seeing the R-Curve of only onerandomness amplifier or a plurality of more than one R-Curves,respectively. The designer or analyst of an encryption circuit or systemor method can choose to benchmark S-box only, 1 Round only, n Roundsonly or Complete Method variants of two randomness amplifiers bypressing S-box button 1844, 1 Round button 1845, n Rounds button 1846 orComplete Method button 1847, respectively. If the (Δ) between therandomness gains of the two randomness amplifiers (for example, thefirst amplifier 1804 being coupled to an encryptor, and the secondamplifier 1812 being coupled to an encryptor) is more than a threshold(δ), then it is determined that one or more of the encryptor circuits orsystems or algorithms are susceptible to differential attacks thateventually may be exploited by adversaries. R-Curves 1851, 1852 and 1853represent the results of three different randomness amplifiers,respectively, where 1853 is an R-Curve of ILLUZIJA. R-Curves 1851 and1852 on Randomness Scope 1850 show that both randomness amplifiers 1804and 1812 are vulnerable to differential analysis attacks once theirrandomness gains are analyzed using the process invention of Deep CipherInvestigation (DCI). In such a state of compromise, encryption circuitdesigners could be enabled to take appropriate steps to mitigate theadverse effects of this type of security problem with the encryptorassociated with each randomness compromised amplifier.

Those of skill in the art will appreciate that the various method steps,illustrative logical and functional blocks, modules, units, andalgorithm steps described in connection with the aspects disclosedherein can often be implemented as electronic hardware, applicationspecific integrated chip (ASIC), computer software, or combinations ofall. To clearly illustrate this interchangeability of hardware andsoftware, various illustrative components, blocks, modules, and stepshave been described above generally in terms of their functionality.Whether such functionality is implemented as hardware or softwaredepends upon the particular constraints imposed on the overall systemand devices. Skilled persons can implement the described functionalityin varying ways for each particular system, but such implementationdecisions should not be interpreted as causing a departure from thescope of the invention described herein. In addition, the grouping offunctions within a unit, module, block, or step is for ease ofdescription. Specific functions or steps can be moved from one unit,module, or block without departing from the invention.

Some or all of the various illustrative methods, algorithms, logical andfunctional blocks, units, steps and modules described in connection withthe aspects disclosed herein, and those provided in the accompanyingdocuments, can be implemented or performed with a processor, such as ageneral purpose processor, a digital signal processor (DSP), anapplication specific integrated circuit (ASIC), a field programmablegate array (FPGA) or other programmable logic device, discrete gate ortransistor logic, discrete hardware components, or any combinationthereof designed to perform the functions described herein, and thoseprovided in the accompanying documents. A general-purpose processor canbe a microprocessor, but in the alternative, the processor can be anyprocessor, controller, microcontroller, or state machine. A processorcan also be implemented as a combination of computing devices, forexample, a combination of a DSP and a microprocessor, a plurality ofmicroprocessors, one or more microprocessors in conjunction with a DSPcore, or any other such configuration.

The steps of a method or algorithm and the processes of a block ormodule described in connection with the aspects disclosed herein, andthose provided in the accompanying documents, can be embodied directlyin hardware, in a software module executed by a processor, or in acombination of the two. A software module can reside in RAM memory,flash memory, ROM memory, EPROM memory, EEPROM memory, registers, harddisk, a removable disk, a CD-ROM, or any other form of storage medium.An exemplary storage medium can be coupled to the processor such thatthe processor can read information from, and write information to, thestorage medium. In the alternative, the storage medium can be integralto the processor. The processor and the storage medium can reside in anASIC. Additionally, devices, blocks, or modules that are described ascoupled may be coupled via intermediary devices, blocks, or modules.Similarly, a first device may be described as transmitting data to (orreceiving from) a second device wherein there are intermediary devicesthat couple the first and second device and also wherein the firstdevice is unaware of the ultimate destination of the data.

The above description of the disclosed aspects, and that provided in theaccompanying documents, is provided to enable any person skilled in theart to make or use the invention. Various modifications to these aspectswill be readily apparent to those skilled in the art, and the genericprinciples described herein, and in the accompanying documents, can beapplied to other aspects without departing from the spirit or scope ofthe invention. Thus, it is to be understood that the description anddrawings presented herein, and presented in the accompanying documents,represent particular aspects of the invention and are thereforerepresentative examples of the subject matter that is broadlycontemplated by the present invention. It is further understood that thescope of the present invention fully encompasses other aspects that are,or may become, understood to those skilled in the art based on thedescriptions presented herein and that the scope of the presentinvention is accordingly not limited by the descriptions presentedherein, or by the descriptions presented in the accompanying documents.

What we claim is:
 1. A method for determining a randomness gainassociated with a plurality of data streams, the plurality of datastreams including at least two input data streams and two outputencrypted data streams, the method comprising the steps of: applying atleast one randomness test block to a first one of the plurality of datastreams to determine a first randomness measurement; applying the atleast one randomness test block to a second one of the plurality of datastreams to determine a second randomness measurement; and determiningthe randomness gain by comparing the first randomness measurement to thesecond randomness measurement associated with the encrypted data stream.2. A baseband processor of a communication device, the basebandprocessor comprising: a randomness inspector unit for determining arandomness gain associated with a plurality of data streams, theplurality of data streams including at least two input data streams andtwo output encrypted data streams, wherein the randomness gain isdetermined in the randomness inspector by: applying at least onerandomness test block to a first one of the plurality of data streams todetermine a first randomness measurement; applying the at least onerandomness test block to a second one of the plurality of data streamsto determine a second randomness measurement; and determining therandomness gain by comparing the first randomness measurement to thesecond randomness measurement associated with the encrypted data stream.3. A method for determining a randomness gain difference, comprising:receiving a first input data stream as an input; applying a firstencryption block to the first input data stream to generate a firstencrypted data stream, determining a first randomness gain by comparinga first randomness measurement associated with the first input datastream to a second randomness measurement associated with the firstencrypted data stream; receiving the first input data stream as aninput; applying a second encryption block to the first input data streamto generate a second encrypted data stream; determining a secondrandomness gain by comparing the first randomness measurement associatedwith the first input data stream to a third randomness measurementassociated with the second encrypted data stream; and determining therandomness gain difference by comparing the first randomness gain to thesecond randomness gain.
 4. A baseband processor of a communicationdevice, the baseband processor comprising: a randomness inspector unitfor determining a randomness gain by:  receiving a first input datastream as an input; applying a first encryption block to the first inputdata stream to generate a first encrypted data stream,  determining afirst randomness gain by comparing a first randomness measurementassociated with the first input data stream to a second randomnessmeasurement associated with the first encrypted data stream;  receivingthe first input data stream as an input; applying a second encryptionblock to the first input data stream to generate a second encrypted datastream;  determining a second randomness gain by comparing the firstrandomness measurement associated with the first input data stream to athird randomness measurement associated with the second encrypted datastream; and  determining the randomness gain difference by comparing thefirst randomness gain to the second randomness gain.
 5. A method ofassessing randomness, comprising: accessing a first set of randomnessgain values associated with a first randomness amplifier from a firstmemory, the first set of randomness gain values including a separaterandomness gain value generated by the first randomness amplifier usingeach one of a plurality of different encryption component blocks;accessing a second set of randomness gain values associated with asecond randomness amplifier from a second memory, the second set ofrandomness gain values including a separate randomness gain valuegenerated by the second randomness amplifier using each one of theplurality of different encryption component blocks; generating a firstset of randomness curves associated with the first set of randomnessgain values and a second set of randomness curves associated with thesecond set of randomness gain values; and displaying any of the firstset of randomness curves and any of the second set of randomness curvesbased on one or more randomness curve selection inputs from a userinterface, wherein at least one randomness curve selection input isassociated with one of the plurality of different encryption componentblocks.
 6. A baseband processor of a communication device, the basebandprocessor comprising: a randomness inspector unit structured andconfigured for: accessing a first set of randomness gain valuesassociated with a first randomness amplifier from a first memory, thefirst set of randomness gain values including a separate randomness gainvalue generated by the first randomness amplifier using each one of aplurality of different encryption component blocks; accessing a secondset of randomness gain values associated with a second randomnessamplifier from a second memory, the second set of randomness gain valuesincluding a separate randomness gain value generated by the secondrandomness amplifier using each one of the plurality of differentencryption component blocks; generating a first set of randomness curvesassociated with the first set of randomness gain values and a second setof randomness curves associated with the second set of randomness gainvalues; and displaying any of the first set of randomness curves and anyof the second set of randomness curves based on one or more randomnesscurve selection inputs from a user interface, wherein at least onerandomness curve selection input is associated with one of the pluralityof different encryption component blocks.
 7. A method assessingencryption component blocks, comprising: generating a first set ofrandomness gain values including a separate randomness gain valuegenerated by a first randomness amplifier using each one of a firstplurality of different encryption component blocks; generating a secondset of randomness gain values including a separate randomness gain valuegenerated by a second randomness amplifier using each one of a secondplurality of different encryption component blocks; generating a firstset of randomness curves associated with the first set of randomnessgain values and a second set of randomness curves associated with thesecond set of randomness gain values; and displaying any of the firstset of randomness curves and any of the second set of randomness curves,wherein a comparison of at least one of the first set of randomnesscurves to at least one of the second set of randomness curves determineswhether one or more of the first plurality of different encryptioncomponent blocks is in a compromised state.
 8. A baseband processor of acommunication device, the baseband processor comprising: a randomnessinspector unit structured and configured for: generating a first set ofrandomness gain values including a separate randomness gain valuegenerated by a first randomness amplifier using each one of a firstplurality of different encryption component blocks; generating a secondset of randomness gain values including a separate randomness gain valuegenerated by a second randomness amplifier using each one of a secondplurality of different encryption component blocks; generating a firstset of randomness curves associated with the first set of randomnessgain values and a second set of randomness curves associated with thesecond set of randomness gain values; and displaying any of the firstset of randomness curves and any of the second set of randomness curves,wherein a comparison of at least one of the first set of randomnesscurves to at least one of the second set of randomness curves determineswhether one or more of the first plurality of different encryptioncomponent blocks is in a compromised state.